Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UNC6293 (threat actor)
Risk
82
Critical
40 techniques 43 tools/malware 0 vulnerabilities 38 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1584
Compromise Infrastructure resource development
T1586
Compromise Accounts resource development
T1650
Acquire Access resource development
›
3 Delivery
1
T1659
Content Injection initial access
›
4 Exploitation
4
T1059
Command and Scripting Interpreter execution
T1609
Container Administration Command execution
T1651
Cloud Administration Command execution
T1548
Abuse Elevation Control Mechanism privilege escalation
›
5 Installation
18
T1110
Brute Force credential access
T1555
Credentials from Password Stores credential access
T1557
Adversary-in-the-Middle credential access
T1010
Application Window Discovery discovery
T1087
Account Discovery discovery
T1217
Browser Information Discovery discovery
T1526
Cloud Service Discovery discovery
T1538
Cloud Service Dashboard discovery
T1580
Cloud Infrastructure Discovery discovery
T1613
Container and Resource Discovery discovery
T1619
Cloud Storage Object Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1098
Account Manipulation persistence
T1136
Create Account persistence
T1543
Create or Modify System Process persistence
T1547
Boot or Logon Autostart Execution persistence
T1554
Compromise Host Software Binary persistence
T1671
Cloud Application Integration persistence
›
6 Command & Control
7
T1115
Clipboard Data collection
T1119
Automated Collection collection
T1123
Audio Capture collection
T1185
Browser Session Hijacking collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
T1092
Communication Through Removable Media command and control
›
7 Actions on Objectives
5
T1020
Automated Exfiltration exfiltration
T1531
Account Access Removal impact
T1134
Access Token Manipulation stealth
T1197
BITS Jobs stealth
T1612
Build Image on Host stealth
Stage risk: Critical High Medium None

Tools & Malware (43)

AppDomainManager BITS Backdoors Cloudflare Workers Conti Exodus Explorer GitHub Global Group Policy Hook Interception Leverage MSBuild MailSniper Malware Payloads Matrix Microsoft OneDrive Msiexec Payload Payload Phishing campaigns Phishing emails PowerShell Process Hollowing PsExec Remote access tools Rootkit Rundll32 STOP Telegram Unknown Web Shell Windows Command Shell XWorm YARA ZLib inter mshta netsh netsh.exe phishing systemd

Indicators of Compromise (38)

Domain
com.apple.loginwindow.plist com.apple.loginwindow artisanaqua.ddnsking.com strokes.zapto.org ITC.ua Log.tmp
Filename
consent.exe Winlogon.exe lsass.exe python.exe heif.dll libde265.dll heif.exe avcodec-61.dll +16 more
SHA-256 Hash
dcb1e9c6b066c2169928ae64e82343a250261f198eb5d091fd7928b69ed135d3 e663c1ba289d890a74e33c7e99f872c9a7b63e385a6a4af10a856d5226c9a822 4982a33e0c2858980126b8279191cb4eddd0a35f936cf3eda079526ba7c76959 8d2c9c2b5af31e0e74185a82a816d3d019a0470a7ad8f5c1b40611aa1fd275cc a0e75bd0b0fa0174566029d0e50875534c2fcc5ba982bd539bdeff506cae32d3 839260ac321a44da55d4e6a5130c12869066af712f71c558bd42edd56074265b 1a037da4103e38ff95cb0008a5e38fd6a8e7df5bc8e2d44e496b7a5909ddebeb
IPv4 Address
91.190.191.117

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (2)
M1021 Restrict Web-Based Content M1041 Encrypt Sensitive Information
Exploitation (15)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +10 more
Installation (21)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +16 more
Command & Control (9)
M1017 User Training M1018 User Account Management M1028 Operating System Configuration M1029 Remote Data Storage M1031 Network Intrusion Prevention +4 more
Actions on Objectives (7)
M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1035 Limit Access to Resource Over Network +2 more

Detection Coverage

40 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (4)

DET0876 Detection of Compromise Accounts DET0884 Detection of Acquire Access DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0349 Detection Strategy for Content Injection

Exploitation (4)

DET0065 Detection Strategy for Container Adminis... DET0345 Detection Strategy for Abuse Elevation C... DET0516 Behavioral Detection of Command and Scri... DET0545 Detection Strategy for Cloud Administrat...

Installation (18)

DET0013 Detection of Local Browser Artifact Acce... DET0096 Account Manipulation Behavior Chain Dete... DET0097 Detection of Application Window Enumerat... DET0112 Boot or Logon Initialization Scripts Det... DET0169 Detection Strategy for Cloud Infrastruct... +13 more

Command & Control (7)

DET0090 Cross-host C2 via Removable Media Relay DET0186 Automated File and API Collection Detect... DET0221 Behavioral Detection Strategy for T1123... DET0341 Clipboard Data Access with Anomalous Con... DET0444 Detection of Command and Control Over Ap... +2 more

Actions on Objectives (5)

DET0098 Detect abuse of Windows BITS Jobs for do... DET0120 Account Access Removal via Multi-Platfor... DET0283 Behavior-chain detection for T1134 Acces... DET0397 Automated Exfiltration Detection Strateg... DET0459 Detection Strategy for Build Image on Ho...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UNC6293

Type: Unknown Active
tracked as Synaptics worm services other system resources public key cryptography +9 more
Infrastructure 7 IOC(s)
50%
Domain
com.apple.loginwindow.plist com.apple.loginwindow artisanaqua.ddnsking.com strokes.zapto.org ITC.ua +1
IPv4 Address
91.190.191.117
Artifacts (31)
consent.exe Winlogon.exe lsass.exe python.exe heif.dll libde265.dll +25
Capability
50%
40 technique(s) 43 tool(s)/malware
AppDomainManager BITS Backdoors Cloudflare Workers Conti Exodus Explorer GitHub +35
collection
T1115 T1119 T1123 T1185 +1
command and control
T1071 T1092
credential access
T1110 T1555 T1557
discovery
T1010 T1087 T1217 T1526 +4
Victim
70%

Targeted Sectors

defense media education financial-services government information-technology

Targeted Countries

RU US AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

AppDomainManager BITS Backdoors
2 Weaponization

Capability (Techniques)

T1583 T1584 T1586 T1650

Capability (Malware)

AppDomainManager BITS Backdoors
3 Delivery

Capability (Techniques)

T1659

Capability (Malware)

AppDomainManager BITS Backdoors
4 Exploitation

Capability (Techniques)

T1059 T1609 T1651 T1548

Capability (Malware)

AppDomainManager BITS Backdoors
5 Installation

Capability (Malware)

AppDomainManager BITS Backdoors
6 Command & Control

Capability (Malware)

AppDomainManager BITS Backdoors
7 Actions on Objectives

Capability (Techniques)

T1020 T1531

Capability (Malware)

AppDomainManager BITS Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.